Executive brief
The Linux kernel's iommufd subsystem (used for managing I/O memory management units) contains a race condition where concurrent operations can cause a NULL pointer dereference. This can result in a kernel crash and denial of service, affecting system availability.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in the iommufd_ioas_change_process() function in the Linux kernel's iommu/iommufd subsystem. The root cause is a race condition between iommufd_ioas_change_process() and iopt_map_file_pages(): the latter creates an IOAS area and inserts it into an interval tree with a NULL pages pointer before dropping the iova_rwsem lock, then fills area->pages later under a different lock (domains_rwsem). A concurrent call to iommufd_ioas_change_process() can observe the area and dereference the still-NULL area->pages pointer. The vulnerability requires local access and iommufd ioctl interface interaction. An attacker can trigger a kernel NULL pointer dereference leading to a kernel panic and system unavailability. The fix has been merged into the Linux kernel mainline.
Affected products
- Linux Linux kernel 7.1.0 and prior (iommufd subsystem)
Timeline
- 2026-09-04: disclosed